evaluating-threat-intelligence-platforms
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
Best use case
evaluating-threat-intelligence-platforms is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
Teams using evaluating-threat-intelligence-platforms should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/evaluating-threat-intelligence-platforms/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How evaluating-threat-intelligence-platforms Compares
| Feature / Agent | evaluating-threat-intelligence-platforms | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Evaluating Threat Intelligence Platforms ## When to Use Use this skill when: - Conducting a formal RFP or vendor evaluation for a TIP solution - Assessing whether the current TIP (e.g., MISP) needs to be replaced or augmented as the CTI program scales - Establishing evaluation criteria aligned to organizational maturity and budget **Do not use** this skill for evaluating feed quality independently of the TIP — feed evaluation is a separate workflow focused on data quality rather than platform capabilities. ## Prerequisites - Documented CTI program requirements: team size, feed sources, integration targets, use cases - Budget range and procurement timeline - Technical staff who will administer the platform (Python/API experience for open-source TIPs) - List of current and planned integrations (SIEM, SOAR, EDR, firewalls) ## Workflow ### Step 1: Define Evaluation Criteria Structure requirements into mandatory (M) and desired (D) categories: **Core TIP Functions**: - M: STIX 2.1 import/export with TAXII 2.1 server - M: REST API for automated IOC ingestion and export - M: Indicator deduplication and TTL management - M: TLP classification enforcement - D: Built-in MITRE ATT&CK integration and technique tagging - D: Graph visualization of indicator relationships - D: Workflow automation for analyst triage **Integrations**: - M: SIEM integration (Splunk, Sentinel, QRadar) via syslog, API, or native connector - M: EDR integration for IOC push (CrowdStrike, Defender, SentinelOne) - D: SOAR integration (XSOAR, Splunk SOAR) for playbook triggers - D: Ticketing system (ServiceNow, Jira) for intelligence task tracking **Operational**: - M: Role-based access control with TLP-aware data segregation - M: Audit logging for all analyst actions - D: Multi-tenancy for MSSP use cases ### Step 2: Evaluate Major TIP Options **MISP (Open Source)**: - Cost: Free (self-hosted infrastructure cost only) - Strengths: Largest community, 250+ modules, extensive ISAC usage, STIX 2.0 native - Weaknesses: Requires dedicated admin, limited visualization, UI dated - Best for: Budget-constrained teams with technical staff; government/ISAC sharing programs **OpenCTI (Open Source)**: - Cost: Free (self-hosted); paid SaaS at ~$3,000–$15,000/year - Strengths: Native STIX 2.1, graph visualization, ATT&CK integration, modern API - Weaknesses: Resource-intensive deployment (Elasticsearch, MinIO required) - Best for: Teams wanting open source with modern UX; SOC/CTI integration focus **ThreatConnect (Commercial)**: - Cost: $50,000–$500,000/year depending on scale - Strengths: End-to-end CTI lifecycle, playbook automation, TC Exchange marketplace, analyst workflow - Weaknesses: High cost; complex implementation; best value at larger scale - Best for: Mature enterprise CTI programs; MSSPs; red team/blue team integration **Anomali ThreatStream (Commercial)**: - Cost: $30,000–$200,000/year - Strengths: Strong feed aggregation, Splunk-native integration, extensive pre-built connectors - Weaknesses: Graph visualization weaker than OpenCTI; UI refresh lagging - Best for: Splunk-heavy environments; teams prioritizing feed volume over analysis workflows **EclecticIQ Platform (Commercial)**: - Cost: $40,000–$300,000/year - Strengths: STIX 2.1 native, collaborative intelligence workbench, strong European customer base - Weaknesses: Smaller partner ecosystem than ThreatConnect - Best for: Teams with MITRE ATT&CK-centric workflows; EMEA-focused organizations ### Step 3: Conduct Proof of Concept Request 30-day PoC from finalists. Test: 1. Feed onboarding: Can your top 5 feeds be ingested within 4 hours? 2. SIEM integration: Can enriched IOCs push to your SIEM in <5 minutes? 3. ATT&CK mapping: Can analysts tag indicators with ATT&CK techniques efficiently? 4. Report generation: Can the platform produce a tactical IOC bulletin with one click? 5. API performance: Can the REST API handle 10,000 indicator queries per day? ### Step 4: Score and Select Use weighted scoring matrix (weight each criterion by organizational priority): ``` Criterion Weight Vendor A Vendor B STIX 2.1 compliance 20% 95 85 SIEM integration 25% 90 70 ATT&CK mapping 15% 85 95 Cost (inverse) 20% 60 90 UI/analyst experience 10% 80 75 Vendor support quality 10% 85 80 TOTAL 100% 82.0 81.5 ``` ### Step 5: Implementation and Onboarding Planning Plan 90-day implementation: - Week 1–2: Infrastructure deployment (cloud or on-prem) - Week 3–4: Feed onboarding and deduplication tuning - Week 5–6: SIEM/SOAR integration and testing - Week 7–8: Analyst workflow configuration and training - Week 9–12: Operational validation and go-live ## Key Concepts | Term | Definition | |------|-----------| | **TIP** | Threat Intelligence Platform — software for collecting, processing, analyzing, and disseminating cyber threat intelligence | | **TAXII Server** | Component of a TIP that serves STIX bundles to consuming systems on request | | **TC Exchange** | ThreatConnect's commercial marketplace for pre-built feed integrations and app connectors | | **Multi-tenancy** | TIP capability to serve multiple organizational units or customers with isolated data environments | | **Deduplication** | Process of identifying and merging duplicate indicators within a TIP to reduce analyst noise | ## Tools & Systems - **MISP**: Open-source TIP used by 6,000+ organizations; strongest ISAC/government community integration - **OpenCTI**: Modern open-source TIP with native STIX 2.1 and graph-based analysis - **ThreatConnect**: Enterprise commercial TIP with lifecycle management and SOAR playbook integration - **Anomali ThreatStream**: Commercial TIP with strong Splunk ecosystem integration - **EclecticIQ**: Commercial TIP with ATT&CK-centric workflow design ## Common Pitfalls - **Selecting TIP before defining requirements**: Technology selection before use case definition leads to expensive mismatches. - **Underestimating administration burden**: MISP and OpenCTI require dedicated admin time (minimum 0.25 FTE); budget accordingly. - **Ignoring data migration costs**: Moving historical intelligence from one TIP to another is costly and often impractical for legacy systems. - **Not testing SIEM integration in PoC**: TIP value depends heavily on downstream integration quality; always test SIEM/SOAR connectivity during evaluation.
Related Skills
tracking-threat-actor-infrastructure
Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a
profiling-threat-actor-groups
Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.
performing-threat-modeling-with-owasp-threat-dragon
Use OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies, and generate threat model reports for secure design review.
performing-threat-landscape-assessment-for-sector
Conduct a sector-specific threat landscape assessment by analyzing threat actor targeting patterns, common attack vectors, and industry-specific vulnerabilities to inform organizational risk management.
performing-threat-intelligence-sharing-with-misp
Use PyMISP to create, enrich, and share threat intelligence events on a MISP platform, including IOC management, feed integration, STIX export, and community sharing workflows.
performing-threat-hunting-with-yara-rules
Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.
performing-threat-hunting-with-elastic-siem
Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.
performing-threat-emulation-with-atomic-red-team
Executes Atomic Red Team tests for MITRE ATT&CK technique validation using the atomic-operator Python framework. Loads test definitions from YAML atomics, runs attack simulations, and validates detection coverage. Use when testing SIEM detection rules, validating EDR coverage, or conducting purple team exercises.
performing-open-source-intelligence-gathering
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s
performing-insider-threat-investigation
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.
performing-dark-web-monitoring-for-threats
Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre
managing-intelligence-lifecycle
Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.